# Grok working online but not in Kibana debugger or Logstash

**URL:** <https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176>\
**Category:** Logstash\
**Created:** [July 14, 2020, 5:46pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176 "2020-07-14T17:46:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![HassaanSalik](https://avatars.discourse-cdn.com/v4/letter/h/59ef9b/32.png) [@HassaanSalik](https://discuss.elastic.co/u/HassaanSalik)\
**Post date:** [July 14, 2020, 5:46pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176/1 "2020-07-14T17:46:07Z")

</div>

Hi,

I am trying to parse gc-log file through grok as shown in [this tutorial](https://logz.io/blog/java-garbage-collection/).

The following grok is working fine in both [Grok Constructor](http://grokconstructor.appspot.com) and [Grok Debugger](https://grokdebug.herokuapp.com/).

`%{TIMESTAMP_ISO8601:timestamp}: %{NUMBER:jvm_time}: \[%{DATA:gc_type} \(%{DATA:gc_cause}\) %{DATA:gc_time}: \[%{DATA:gc_collector}: %{NUMBER:young_generation_before}\K\-\>%{NUMBER:young_generation_after}\K\(%{NUMBER:young_generation_total}\K\)\, %{NUMBER:collection_time} .*?\] %{NUMBER:heap_before}\K\-\>%{NUMBER:heap_after}\K\(%{NUMBER:heap_total}\K\)\, %{NUMBER:gc_duration} .*?\] \[.*?\: .*?\=%{NUMBER:cpu_time} .*?\=%{NUMBER:system_time}\, .*?\=%{NUMBER:clock_time} .*?\]`

For the following line

`2020-06-17T21:10:03.372-0700: 332100.747: [GC (Allocation Failure) 332100.749: [ParNew: 4826611K->107208K(5505024K), 0.0377490 secs] 7922907K->3203567K(11796480K), 0.0403224 secs] [Times: user=0.30 sys=0.00, real=0.04 secs]`

But it fails both in Kibanna's Grok Debugger and Logstash.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 14, 2020, 6:07pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176/2 "2020-07-14T18:07:48Z")

</div>

I suggest you read [this](https://discuss.elastic.co/t/help-needed-in-grok/213827/2) post.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 6:07pm UTC](https://discuss.elastic.co/t/grok-working-online-but-not-in-kibana-debugger-or-logstash/241176/3 "2020-08-11T18:07:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.